What’s Vulnerable › Vulnerabilities
CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2026-10-20
- EPSS: 1.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-23 · updated 2026-10-21
- Weakness: CWE-918
Description
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
Summary
Plex Media Server before 1.43.3.10861 is vulnerable to server-side request forgery via the '/player/timeline' endpoint. An attacker using any X-Plex-Token value can supply a full URL in the 'protocol' parameter and force the server to POST to an arbitrary destination, which can be used to probe or reach internal systems. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, so exposure should be treated as urgent. Update to 1.43.3.10861 or later, and follow CISA BOD 26-04 guidance, including evaluating internet exposure and applying forensics triage where required.
يعاني Plex Media Server قبل الإصدار 1.43.3.10861 من ثغرة تزوير الطلبات من جانب الخادم (SSRF) عبر المسار '/player/timeline'. يمكن للمهاجم باستخدام أي قيمة لـ X-Plex-Token وضع رابط كامل في المعامل 'protocol' لإجبار الخادم على إرسال طلب POST إلى وجهة يختارها، ما قد يُستغل لاستهداف الأنظمة الداخلية. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة الاستغلال مع استغلال نشط، لذا يجب التعامل معها بأولوية عالية. يُنصح بالترقية إلى الإصدار 1.43.3.10861 أو أحدث، واتباع إرشادات CISA BOD 26-04 بما يشمل تقييم تعرض الأصول للإنترنت وتنفيذ متطلبات الفرز الجنائي عند الاقتضاء.
Affected products
- Plex Media Server: before 1.43.3.10861 — fixed in 1.43.3.10861
How to fix
Upgrade to a fixed version: Plex Media Server 1.43.3.10861. Check the vendor advisory for mitigations.
References
- https://forums.plex.tv/t/plex-media-server/30447/711
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-96652
- https://zmain.info/blog/plex2shell
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652
Get alerted when CVE-2026-96652 or the next vulnerability affects your stack